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AUTOMATIC METHOD FOR LEARNING FREQUENT CHRONICLES IN AN 
ALARM LOG FOR SUPERVISION OF DYNAMIC SYSTEMS 

DESCRIPTION 

5 TECHNICAL DOMAIN 

The purpose of this invention is an 
automatic method and system for learning frequent 
chronicles in an alarm log of a dynamic system for 

10 supervision of this alarm log. 

Examples of dynamic systems concerned by 
the invention include telecommunication networks, 
computer networks and any other industrial 
installations in which equipment is supervised, such as 

15 nuclear power stations, assembly lines, automated 
factories, etc. 

Supervision of a dynamic system consists of 
monitoring that it is operating correctly, collecting 
information about its state or the state of components 

20 of the system, and detecting and identifying 
malfunctions that might occur. This supervision is 
usually done by a computer system that centralises 
information sent by components of the dynamic system at 
different times. The supervision system may receive a 

25 wide variety of information; for example, procedure 
execution information, alert messages; they are often 
related to physical sensor measurements. 

The supervision system receives information 
in the form of alarms, each alarm being formed from a 

30 given type of event, for example a specific electrical 
equipment in the dynamic system is de-energised (in the 
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form of a coded message) , associated with its 
occurrence date (frequently in the form of an integer 
number of time units) . In the case of a 

telecommunication network, examples of alarm types 
5 include "signal loss" or "transmission -frame loss", 
that can be grouped under the more general type of 
"transmission failure". 

Alarms received by the supervision system 
are stored in an alarm log corresponding to a list of 

10 received alarms ordered in time according to the 
occurrence dates between a log start date and end date. 

A supervision system may receive a very 
large number of alarms with considerable variations 
during time; for example, the rate may vary from 

15 several hundred messages per second to a few tens or 
less. Some received alarms are not independent but are 
the .result of alarm "cascades" due to the 
interdependence of some components of the supervised 
dynamic system. 

20 An analysis of the alarm log, particularly 

to find the genuine causes of malfunctions in order to 
suggest an appropriate reaction (preventive or 
corrective) is a difficult task because relevant groups 
of alarms have to be isolated from the mass of 

25 information in the log. One possible representation 
for these alarm groups uses sets of events related by 
time constraints (in the. form of graphs,) ; these are 
called chronicles. Knowledge about the variation of a 
dynamic system may be represented by such chronicles 

30 because it can be considered that each chronicle* is one 
possible scenario for evolution of the system. 
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Therefore, this knowledge acquired through the 
chronicles provides a means of anticipating the 
behaviour. of the dynamic system and thus enables better 

. control over it. 
5 . For example, in the case of 

telecommunication network, alarms are generated 
automatically by various network equipment (switches, 
multiplexers,, mixers, etc.) and are sent to a central 
supervisor. The alarm flow then contains alarms due to 
10 ' network "automation that can be qualified as being 
normal,; and alarms related to malfunctions; if a 
chronicle corresponds to a malfunction, its alarms will 
be analysed to find the source of this malfunction and 
to correct it. ' Most supervision and control systems 
15 have art architecture in three modules 14, 16 and 15 as 
illustrated in- Figure 1; a supervision system 17 is 
connected to a dynamic system 10 interacting with the 
exterior 11., the components of which are provided with 
sensors 12 and that may be controlled by actuators 13; 
20 the sensors 1.2 send signals to a detection module 14 
that -generates alarms from these signals and transmits 
them to a diagnostic module 16 that interprets the 
alarms; identifies situations characteristic of the 
■ evolution , 1Q, locates components of 10 involved in 
25 these -situations, determines the causes of any 
malfunctions and transmits this information to a 
decision -module 15 that then determines actions to be 
accomplished (to achieve a given objective or to bring 
the supervised system into a normal situation) on 
30 components of 10 and transmits commands accordingly to 
the actuators 13 of the dynamic system. 



Learning of chronicles takes place in the 
diagnostic module and relevant information distributed 
throughout the alarm log is isolated. The 
identification of characteristic situations encountered 
during evolution of the dynamic system, particularly 
related to anomalies, and detection of the causes of 
these situations for diagnostic purposes, are based on 
chronicles discovered during learning. The chronicles 
thus provide a means of anticipating some behaviours of 
the dynamic system. 

Therefore, discovery of the chronicles in 
an alarm log is an essential step for supervision of a 
dynamic system. 

If an alarm is represented in the form of a 
pair (A, t A ) , where A denotes an event type and t A is 
its occurrence date, then the time constraint "from A 
to B" between two alarms (A,t A ) and (B,t B ) (or the 
constraint "from t A to t B ") represented by a time 
interval [t~,t + ] placed between events A and B, means 
that the following relation is valid for occurrence 
dates : 

t" £ (t B - t A ) < t + , 
the lack of a constraint between two instants being 
represented by the constraint [- 00 ,+ 00 ]. 

A chronicle (or scenario or time pattern) 
in the alarm log is composed of data consisting of k 
elements, where k is the size of the chronicle, in 
other words k event types in the log (or associated 
alarms) and time constraints between the corresponding 
k occurrence dates. It can be said that a chronicle is 
a set of event types for which the occurrence dates are 



constraints and these constraints may be in the form of 
a time graph. 

A graph of time constraints is an oriented 
graph in which the vertices are dates and the arcs are 
labelled by constraints between these dates; for 
example for two dates ti and t 2 , the arc from ti to t 2 
is labelled by the constraint "from ti to t 2 " . 

There may be many examples of production of 
a- given chronicle C in the alarm log, and it is then 
said that there are several instances of chronicle C; 
therefore an instance of a chronicle C corresponds to a 
list of alarms in the chronicle """Tor events associated 
with these alarms), ordered in time and extracted from 
the log. 

Figure 2 illustrates an example chronicle, 
involving event types a (in 1 or 4), b (in 2) and c (in 
3) with indications of time intervals related to time 
constraints (for example 5); a type event (in 1) takes 
place at an initial time, it precedes a type c event 
(in 3) that occurs between 2 and 5 time units later, 
then a type b event occurs between 3 and 10 time units 
later and another type of event that occurs between 2 
and 10 time units later (after the initial event), 
subsequent type b and a events, occurring between 1 and 
6" time units and between 0 and 8 time units 
respectively after the type C event (in 3) . 

We will now consider a subsequent list of 
events el to e8, with reference to the . chronicle in 
Figure 2, in which for example event el corresponding 
to the occurrence of a type a alarm at date t = 4 time 
units is denoted el(a,t=4): el(a,t=4), e2(d,t=5), 
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e3(a,t=6), e4(c,t=8), e5(b,t=10), e6(e,t=ll), e7(a,t=12 
), e8(b,t=14), in a list in which there are eight 
alarms (related to the eight events el to e8) with five 
different types denoted a, b, c/ d, ■ and e. In this 
5 example, four instances of the chronicle in Figure 2, 
namely { el , e4 , e5, e7 } , { e3, e4 , e5, e7 } , { e3 , e4 , el , e8 } and 
{el, e4, e7, e8 } , can be recognised that use the three 
types of alarms a, b and c and satisfy the relations 
between occurrence dates in the chronicle. 

10- -. The frequency of a chronicle is the number 

of instances of this chronicle in the alarm log. 
Therefore, it is the real number of occurrences in the 
chronicle rather than a genuine frequency; however, a 
genuine frequency (or average occurrence rate) can be 

15 obtained trivially by dividing this number of 
occurrences by the duration of the alarm log, in other 
words the difference between its end and start dates, 
since the log is analysed at a given end date. The 
size (or length) of the alarm log is the' number of 

20 alarms contained in it. The size of a chronicle is the 
number of events from which it is formed, in other 
words the size of its instances. 

A chronicle is said to be frequent in a log 
when its frequency in the log exceeds a given threshold 

2 5 frequency fmin- 

The learning method for frequent chronicles 
in an alarm log corresponds to exploration and analysis 
of the log to discover chronicles for which the 
frequency of instances in the log exceeds a given 

30 threshold frequency. The objective is to explore alarm 
sequences considering both events and time constraints 
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between their occurrence dates to determine the 
chronicles, and also to recognise identified chronicles 
through their instances within the log (the number of 
times that a chronicle is recognised in the log being 
5 equal to its frequency) . 

STATE OF PRIOR ART 

There are several algorithms [1,2,3,4] 

10 capable of constructing and discovering all frequent 
chronicles present in an alarm log, and many variants 
of these algorithms have been developed, particularly 
the FACE [4,6] (Frequency Analyser for Chronicle 
Extraction) system. 

15 Automatic learning of chronicles on a 

computer is very expensive in calculation and memory 
occupancy terms, and furthermore, an excessive 
reduction in the threshold frequency (to find more 
unusual chronicles) can lead to a combinatorial 

20 explosion phenomenon that saturates the computer* The 
high cost is the reflection of the complexity of the 
method, which is mainly related to two factors: (i) 
the number of alarms present in the log (the size of 
the log to be processed) (ii) the threshold frequency 

25 fmin/ fixed by the user that fixes the minimum frequency 
of chronicles to be looked for in the log. 

It will be noted that concerning management 
of time constraints, a graph of time constraints may 
have several . equivalent representations (therefore 

30 there will be the same number of equivalent 
representations of a corresponding chronicle) but there 
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is only one minimum representation (in terms of a 
partial order relation) ; this representation is 

usually calculated and its global consistency is 
usually verified using a well known Floyd-Warshall type 
5 algorithm with a complexity of 0(n 3 ) where n is the 
number of instants (or dates) in the graph [5] and is 
therefore related to the number of alarms. 

In practice, an expert in the subject fixes 
the maximum size L max of the time constraints, in other 

10 words the maximum duration between alarm occurrence 
dates in a chronicle (or duration of the chronicle), 
and the threshold frequency fmin to learn chronicles in 
a given alarm log J, within a reasonable time. This 
« reasonable time » will obviously be different if the 

15 dynamic system supervision and control are done in real 
time and if the log is analysed off line, for example 
for expertise acquisition needs. 

The result of learning is then the set E of 
chronicles in the log E = {Ci,...,C M } with frequencies 

20 greater than or equal to f^n and with durations less 
than or equal to L max as indicated in Figure 3. 

Figure 3 indicates learning steps typical 
in prior art: an alarm log 30 is sent to a frequent 
chronicle learning module 31 with a threshold frequency 

25 fmin and maximum size of time constraints L ma x 30, that 
then produces frequent chronicles of J: CI,..., CM in 32. 

It frequently happens that those skilled in 
the art cannot reduce the threshold frequency f min (the 
30 second complexity factor (ii) mentioned above) below a 
relatively high level due to time constraints in the 
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learning method, and in this case the important risk is 
that 'rare" chronicles with frequencies less than f^n 
will be missed, but they may be very important for good 
supervision of a dynamic system. These cases apply 
5 particularly to epiphenomena . An epiphenomenon is the 
occurrence of a pattern in an alarm log with a high 
rate but over short intervals with respect to the 
duration of the log, on average the appearance rate of 
the pattern is very low and therefore its frequency is 

10 also very low particularly compared with fmi n ; Figure 4 
illustrates such a case. Prior art is incapable of 
learning chronicles associated with epiphenomena, for 
example by reducing the' threshold frequency by a factor 
of ten, without significantly increasing calculation 

15 times. 

In an attempt to solve this problem of 
detection of low frequency chronicles, those skilled in 
the art will vary the first complexity factor (i) to 
reduce the size of the alarm log based on the fact 

20 that, statistically, dividing the size of the log by a 
given factor divides the threshold frequency . by a 
factor of the same order of magnitude (for a similar 
processing time) . However, this technique is very 
difficult to implement and may have serious 

25 disadvantages; if alarm blocks are deleted from the 
log without adequate precautions, the risk of deleting 
chronicles, including high frequencies, is very high 
which degrades supervision and is hardly acceptable; 
as for epiphenomena, their frequencies will drop 

30 statistically even faster than the size of the log, 
which will make it even more difficult to discover 
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them; if selected alarms are withdrawn from the log, 
this is usually done based on a prior analysis of this 
log (usually by experts), for example by eliminating 
alarms from some chronicles, and in this case the total 
processing time increases significantly; and in 
particular can make supervision in real time 
impossible. . . 

These difficulties encountered by those 
skilled in the art illustrate the considerable 
practical importance of the time factor in learning, ' 
and it is clear that there is a need to be able to 
reduce the chronicle learning time, even when 
epiphenomena are not being searched for, in order to 
supervise dynamic systems or for the acquisition of 
knowledge (expertise) on these systems. 

PRESENTATION OF THE INVENTION 

The invention is thus intended to improve 
the processing speed of an application for learning the 
chronicles in an alarm log so that in particular the 
threshold frequency can be reduced, to search for 
chronicles corresponding to epiphenomena while 
maintaining acceptable processing times. 

The invention uses data analysis techniques 
like those related to data classification (or 
clustering), in other words data grouping modes. There 
are very many algorithms that calculate such data 
aggregates or groups or clusters. 

The invention relates to an automatic 
learning method comprising preprocessing of the alarm 
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log without the disadvantages of prior art, for 
producing partial alarm logs (small sizes), starting 
from the original alarm log on which learning is done 
on each of them ' subsequently. This automatic 

5 "breakdown" into partial logs must be done 
'intelligently 1 a systematic or random breakdown of the 
alarm log into alarm blocks does nothing to improve the 
frequencies if the patterns are distributed at random; 
this type of breakdown is incapable of producing low 
10 frequency learning since the frequency of an 
epiphenomenon will drop faster than the size of the 
log . 

The automatic breakdown preprocessing 
according to the invention assures that the partial 

15 logs will be rich in alarm sequences that resemble each 
other in terms of the alarms produced. 

In -■ particular, concerning the 

epiphenomenona, this preprocessing tends to select 
areas in the alarm log corresponding to appearance 

20 ratio peaks (see peaks 41,42,43 in Figure 4) while 
reducing the size of the log to be analysed, which 
means that the effective frequency of an epiphenomenon 
in the new log can be increased so as to make it 
detectable as soon as this frequency reaches or exceeds 

25 the threshold frequency, while the frequency of the 
epiphenomenona would have been too low if learning had 
been done directly on the original log; by reducing 
the size using the procedure according to the 
invention, the frequency of the rare chronicle 

30 corresponding to the similarity type in the partial 
log, is increased above the threshold. 
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The essential phenomenon on which the 
invention is based is that if two parts, or alarm 
sequences, in the original alarm log contain instances 
of the same chronicles, then these parts must be 
5 relatively similar in that they must contain several 
elements in common and in a more or less similar order; 
if each of these parts is described by a set of 
parameters (forming a representation of the part) , 
associated with various aspects of its content in 

10 alarms, then the similarity of parts results in the 
similarity (or proximity) of sets of parameters 
representative of these parts, in the parameters space. 
On the other hand, if these parts do not have 
chronicles in common, then the breakdown into parts 

15 according to the invention adds nothing that is not 
available with direct learning; however, in this case, 
the advantage of the invention is that it cannot be 
used for learning by trial and error. 

More precisely, in a so-called general 

20 mode, the invention is an automatic method for learning 
frequent chronicles in an alarm log of a dynamic 
system, for supervision of this system, the alarms 
being associated with a plurality of events in a system 
with a plurality of types, characterised in that it 

25 comprises the following steps: 

a) automatic selection and grouping of 
alarm sequences in the alarm log so as to form groups 
of sequences of similar alarms; and 

b) automatic generation of a partial alarm 
30 log for each group of sequences of similar alarms 



obtained in step a) , starting from alarms belonging to 
sequences in this group; and 

c) automatic learning of frequent 
chronicles in each partial alarm log obtained in step 
b) so as to generate a partial set of frequent 
chronicles for each partial alarm log obtained in step 
b) , and production of a set of frequent chronicles in 
the alarm log starting from frequent chronicles for 
each partial set of frequent chronicles obtained. 

For example, it is possible to form the set 
of frequent chronicles in the alarm log by a union of 
chronicles of partial sets of frequent chronicles, 
which has the advantage that it eliminates none of the 
chronicles obtained during each partial log learning 
operation . 

Obviously, other choices are possible, 
those skilled in the art would for example decide to 
eliminate chronicles with a frequency less than a given 
frequency (particularly when the threshold frequency is 
not the same for learning the various partial logs), or 
to eliminate chronicles containing some alarm types, 
etc. 

This general mode is represented in Figure 
5: in an alarm log J 50, sequences of alarms 51 are 
selected Si, S 2 ,.~, S p and are then grouped 52 into 
groups with similar sequences G x , G 2 , . . , G r , thus 
executing step a) in the general mode. Group alarms 
are then used to produce 53 the partial logs Ji, J 2 ,.»,Jr 
according to step b) in the general mode. Then, 
frequent chronicles 54 are learned in each transmitted 
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partial log Ji and the partial set E± of frequent 
chronicles of J± is determined 55, according to step C, 
in the general mode; finally, a set E of chronicles of 
log J is formed 56 starting from chronicles of, the 
5 various partial sets Ei . 

A comparison with Figure 3 clearly shows 
the differences in learning chronicles according to 
prior art and according to the invention; direct 
learning of the log J in 30 and 31 to obtain all 

10 frequent chronicles in 32, is replaced by sequencing of 
J in 51, followed by grouping of similar sequences in 
52, in order to produce the partial logs 53 on which 
^partial' learnings are done in 54 and 55 so that 
frequent chronicles of "the original log J can then be 

15 determined from chronicles in partial logs 56. 
Automatic grouping of similar sequences is an essential 
point of the invention because this is how the partial 
logs that are potentially rich in frequent chronicles 
are obtained. 

20 

The invention also relates to a device for 
using the new method described above, in other words a 
system for automatic learning of frequent chronicles in 
an alarm log of a dynamic system, for supervision of 

25 this system, comprising means of acquisition of alarms 
in the dynamic system and generation of an alarm log 
starting from acquired alarms, each alarm being 
associated with an event in the dynamic system obtained 
from among a plurality of events with a plurality of 

30 types and an occurrence date, means of transmission of 
the alarm log and chronicle learning means capable of 
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using an automatic method for learning chronicles in an 
alarm log, with frequencies greater than or equal to an 
adjustable minimum frequency threshold fo and an 
adjustable maximum duration T, and that can transmit 
5 the chronicles obtained, characterised in that it also 
comprises : 

- an alarm sequence selection and grouping 
module capable of receiving an alarm log capable of 
selecting and grouping sequences of alarms in the alarm 

10 log, and capable of forming a group of similar alarm 
sequences and transmitting this group; 

- a module for producing a partial alarm 
log starting from the alarms of a group of similar 
alarm sequences received from the module that selects 

15 and groups alarm sequences in the alarm log, the module 
being capable of transmitting the partial alarm log 
obtained to the chronicle learning means; 

a module for producing a set of frequent 
chronicles in the alarm log, from chronicles 

20 transmitted by chronicle learning means, the module 
being capable of transmitting chronicles from the set 
of frequent chronicles. 

This learning system according to the 
25 . invention is illustrated in Figure 6: in this case, 
the learning system 66 is shown with reference to the 
diagnostic module 16 of a supervision system 17 of a 
dynamic system 10. Alarms 60 are transmitted to alarm 
acquisition means 61 and means of generating an alarm 
30 log J. The log J is transmitted to a module M2 for 
selection and grouping of alarm sequences 62. The 



module selects sequences Si, S 2 ,.~, S p (with a variable 
number p) and forms groups of similar sequences Gi, 
G 2 ,.., G r (with a variable number r) ; it transmits each 
group G k , where k varies from 1 to r, to a module M3 
producing a partial alarm log 63. Each partial log J k , 
where 1 < k < r, is generated from alarms of sequences 
in the corresponding group G k . Module M3 transmits 
each partial log J k to the means M4 of learning 
frequent chronicles 64, with variable minimum frequency 
fo and maximum duration T, which then produce a partial 
set E k of frequent chronicles of J k containing a number 
M(k), that varies depending on the index k, of 
chronicles designated by Ci (k ),..., C M (k) • Finally, a 
module M5 for the production of a set of chronicles 65, 
generates a set E of chronicles of J starting from 
chronicles of all partial sets E k transmitted by the 
module M4 . Module M5 then transmits the chronicles 
Ci,..., C M of E so that they can be used by the 
supervision system. Those skilled in the art will note 
that modules M2 and M3 are not present in learning 
systems used in supervision systems according to prior 
art, and module Ml transmits the log J directly to the 
learning means M4 that directly produces the set E 
(therefore, module M5 is also absent) . 

BRIEF DESCRIPTION OF THE FIGURES 

The characteristics and advantages of the invention 
presented above, and others that will become clear from 
the following description of particular embodiments 



SP 22843 HM 



17 



given as examples, will become clear with reference to 
the attached drawings on which: 

- Figure 1 shows a logical diagram of a supervision 
system for a dynamic system like that described above. 

5 - Figure 2 shows an example of a chronicle using 

events of three types a, b and c. 

- Figure 3 is a block diagram showing learning of 
frequent chronicles according to prior art. 

- Figure 4 shows a curve of the occurrence rate t 
10 (ordinate) of a pattern as a function of the time t 

(abscissa), typical of an • epiphenomenon. 

Characteristic peaks 41, 42 and 43 are shown. 

- Figure 5 is a block diagram showing learning of 
frequent chronicles according to the invention in its 

15 general mode. 

- Figure 6 is a block diagram showing a learning 
system according to the invention, in a supervision 
system for a dynamic system. 

20 

DETAILED PRESENTATION OF PARTICULAR EMBODIMENTS 

Automatic selection of alarm sequences 
within an alarm log in step a) in the general mode of 
the invention is an important step in the method that 
25 can be carried out" in several ways: for example, it is 
possible to use one sequence for each alarm in the log, 
therefore each sequence would contain an alarm, but in 
this case the number of sequences to be grouped would 
be very large. 

30 Advantageously, in a so-called mode with 

breakdown, in step a) in the chronicle learning method 
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according to the invention, alarm sequences are 
automatically selected by automatic breakdown of the 
alarm log into parts, each part being formed of alarms 
in the alarm log for which the occurrence dates are 
ordered in time and are included between a start date 
and end date associated with this part of the log, each 
part of the alarm log defining a selected alarm 
sequence in which the alarms belong to this part. This 
mode may be used to select sequences in step a) in the 
general mode. 

The alarm log may be broken down into parts 
or time slots using several different methods: as non- 
limitative examples, the parts may have different or 
identical sizes (in terms of the number of alarms 
contained) , they may have the same duration or variable 
durations, they may be separate or they may have alarms 
in common, they may form a partition of the alarm log 
in the set, or on the contrary they may ignore some 
alarms, etc. 

Advantageously, the union of the parts of 
the alarm log will reconstitute the log so as not to 
lose any alarms that could belong to instances of 
chronicles at this stage in the learning method: any 
alarm in the log will then belong to at least one of 
the parts of the log. 

According to one particular mode of the 
invention, called the mode with complete breakdown, the 
previous breakdown of the alarm log into parts is such 
that every alarm in the alarm log belongs to at least 
one of the parts of the alarm log. This mode has the 
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advantage that it does not eliminate any alarm in the 
alarm log during the breakdown. This mode, combined 
with the with breakdown mode, may be used to select 
sequences in step a) in the „ general mode. 

5 

Sequences selected in step a) with 
similarities may be grouped using a similarity 
measurement in a space in which each alarm sequence is 
described by a set of parameters that may be seen as 

10 defining the coordinates of a point in this space 
called ' the sequence representation space. Each 
parameter in a sequence, or coordinate of the point 
representative of the sequence in the representation 
space, is associated with the description of the alarm 

15 content of the sequence in terms of a given alarm type. 
Thus, if there are A distinct alarm types to describe 
the content of the alarm sequences, the sequence 
representation space has A dimensions. . The value of a 
coordinate of a sequence corresponds to the weight of 

20 the sequence in alarms of the type associated with this 
coordinate . 

The importance of the choice of a data 
representation prior to grouping operations of these 
data, is well known to specialists in data 

25 classification. There is a very large number of 
possible representations for data depending on the 
characteristics attached to them: this variety of 
representations is reflected particularly by the 
different dimensions of the representation space. 

30 One of the particular modes of the 

invention uses a so-called weighted representation in 
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which each alarm sequence selected in step a) in the 
method is represented in the representation space with 
dimension A, by a point with A coordinates, the 
coordinate with rank j where j is any. integer index 
5 between 1 and A, is equal to the number of times that 
the alarm type associated with index j appears in the 
alarm sequence. 

Those skilled in the art know that the 

10 similarity measurement mentioned above used to 
calculate grouping of sequences using 'proximity' 
' measurements of sequences in the representation space, 
particularly in classification method grouping 
algorithms, should be understood in the mathematical 

15 sense, in other words this measurement is not 
necessarily a distance (it does not have to respect 
triangular non-equality and the term semi-metric is 
then used, for example the cosine measurement that 
measures cosine of the angle between two vectors for 

20 which the components are the coordinates of the points 
representing the corresponding two sequences 
considered) . However, this similarity measurement is 
usually a distance and is therefore capable of 
providing a metric for the representation space. 

25 Without being limitative., examples of metrics include 
the Minkowski metric (or distance) (that includes the 
Euclidian distance and the 'City-block' distance or the 
Manhattan distance as special cases), the Mahalanobis 
distance, the Chebychev distance, etc. 

30 Points representing alarm sequences closest 

to each other in the sequence representation space form 
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clusters, and each cluster corresponds to a group of 
sequences said to be similar. The proximity criterion 
for two points in the representation space being that 
if the similarity measurement of these points is less 
5 than or equal to a given threshold value, then the two 
points belong to the same cluster, and if the 
similarity measurement of these points is greater than 
the threshold value, then the two points belong to 
distinct clusters . 

10 There is a very large number of data 

grouping algorithms at the moment, some of which even 
handle invariance (by linear transformations) of 
clusters due to prior normalisation of data. 

In one advantageous embodiment of the 

15 invention called the with sequence grouping mode, step 
a) in the method consists of automatic grouping of 
alarm sequences to form groups of similar alarm 
sequences, using a grouping method. Therefore, this 
mode may be used for grouping in step a) in the general 

20 mode, and it may also be used jointly either with the 
with breakdown mode or with the with complete breakdown 
mode to perform step a) in the general mode. 

The choice of how alarm sequences will be 
represented affects both the relevance of sequence 

25 groupings and the complexity of similarity measurement 
calculations to be made (due to the number of 
dimensions in the associated representation space) . 
The content of an alarm sequence in the alarm log may 
be described more or less exhaustively: for example, 

30 if the log contains N distinct alarm types, then it 
will be possible to describe the alarm content of the 
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sequence on the basis of these N alarm types, but it 
will also be possible to decide to describe this 
content based on a smaller number of alarm types and in 
this case some alarms (although they still appear in 
the sequence) corresponding to types missing from the 
representation, will not be described; however, in 
this case, the dimension of the representation space is 
smaller, which is advantageous from the point of view 
of the complexity of the grouping calculations. 

Thus, in one particular mode of the 
learning method according to the invention, called the 
with type selection mode, groups of similar alarm 
sequences are formed in step a) with the following 
steps consisting of: 

- representing each of the alarm sequences 
in the alarm log by its content, based on a set of 
alarm types with A elements taken from among distinct 
alarm types in the alarm log, with a number greater 
than or equal to A, in the alarm sequence 
representation space with dimension A; and 

- automatically grouping alarm sequences in 
the alarm log and in the alarm sequence representation 
space, so as to form groups of similar alarm sequences. 
This mode is dependent on the general mode or the with 
breakdown mode or the with complete breakdown mode or 
the with grouping of sequences mode. 

In particular, this with type selection 
mode may advantageously use the weighted representation 
of alarm sequences described above. Therefore, this 
with type selection mode can be used to form groups in 
step a) in the general mode, and it may also be used 
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jointly either with the with breakdown mode or with the 
with complete breakdown mode or with the with grouping 
of sequences mode, possibly combined with one of the 
previous two modes, to perform step a) in the general 
5 mode . 

Simple elimination of some of the alarm 
types present in the alarm log has the disadvantage 
that some alarms (eliminated types) are not described. 

10 To describe all alarms while reducing the number of 
dimensions in the alarm sequence representation space, 
it is possible for ' example firstly to group similar 
alarm types in the alarm log, particularly using a 
grouping method, to create groups of alarm types (the 

15 number S of groups being less than or equal to the 
initial number N of alarm types) , and then to describe 
the content of the alarm sequences -based- on these S 
groups of alarm types. Thus, the number of dimensions 
in the representation space is only S, which . is 

20 advantageous for grouping calculations and furthermore, 
any alarm in any sequence could always be described 
since its type appears in at least one of the S groups 
of types. 

A simple example of a reduction in the 
25 number of types was given above for a telecommunication 
network: the two types of « signal loss » and 

« transmission frame loss » alarms may be described by 
a higher level type (usually resulting from a 
functional link between the types considered) which is 
30 « transmission failure ». A representation space is 
associated with the description of types, like in the 
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general case of data processing (in this case data are 
alarm types in the alarm log) . 

An expert in the subject will note that 
everything described for the alarm sequences and the 
5 breakdown of an alarm log. .and the various processings 
of these entities can be transposed to alarm types by 
analogy, provided that there is an available 
representation of these types or sequences of types • 

10 Some of the previous S groups can also be 

eliminated to retain only . a small number S' , the 
dimension of the representation space then being S' . 
These methods for reducing the representation space by 
grouping of types are then combined with a later 

15 grouping of alarm sequences to form groups of similar 
alarm sequences that can be used to generate partial 
logs in step b) of the learning method according to the 
invention . 

Thus, in one particular . embodiment of the 
20 learning method according to the invention called the 
with type grouping mode, groups of similar alarm 
sequences are formed in step a) • consisting of the 
following steps: 

- automatically grouping alarm types in the 
25 alarm log so as to form groups of similar alarm types, 

the result of grouping being a number S of groups of 
alarm types; and 

- representing each alarm sequence in the 
alarm log by its content based on S' groups of alarm 

30 types, where the number S ! is less' than or equal to S 
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obtained in the previous step, in an alarm sequence 
representation space, with dimension S'; and 

- automatically grouping alarm sequences in 
the alarm log in the alarm sequence representation 

5 space, so as to form groups of similar alarm sequences. 

With type grouping mode can therefore be 
used to form groups in step a) in the general mode, and 
it may also be used* jointly either with the with- 
breakdown mode or with the with complete breakdown mode 

10 or with the with grouping of sequences mode, possibly 
combined with one of the two previous modes to perform 
step a) in the general mode. 

In particular, automatic grouping of alarm 
sequences in the with type grouping mode may consist of 

15 automatically forming groups of similar sequences in 
the alarm log, each' group of similar sequences being 
associated with a group of alarm -types and resulting 
from the selection of alarm sequences in the alarm log 
for which the content of alarms of the same types as 

20 the types in the group of types considered exceeds a 
given threshold for this group. This grouping method 
has the advantage that it is very simple to implement. 

In one particular embodiment of the 
learning method according to the invention called the 

25 type grouping with thresholds mode, groups of similar 
alarm sequences are formed in step a) using the 
following procedure : 

- automatically grouping alarm types in the 
alarm log so as to form groups of similar alarm types, 

30 the result of grouping being a number S of groups of 
alarm types; and 
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- representing each alarm sequence in the 
alarm log by its content based on a number S 1 of groups 
of alarm types less than or equal to S obtained in the 
previous step, in an alarm sequence representation 

5 space with dimension S 1 ; and 

- automatically forming groups of similar 
sequences in the alarm log, each group of similar 
sequences being associated with a group of alarm types 
and resulting from the selection of alarm sequences in 

10 the alarm log for which the content of alarms of the 

same type in the group of types considered exceeds a . 

given threshold for this group. 

Therefore the type grouping with thresholds 

mode can be used to form groups in step a) in the 
15 general mode, and it can also be used jointly either 

with breakdown mode or with complete breakdown mode to 

execute step a) in the general mode. 

In one particular mode called with type 
20 grouping mode, it is also possible to group alarm types 
in the with type grouping mode or in the type grouping 
with threshold mode, by using a grouping method 
applicable to alarm types in the alarm log to form 
groups of similar alarm types. Those skilled in the 
25 art will do this by choosing a representation space for 
these alarm types, for which he could also reduce the 
number of dimensions using various methods described 
above but applied to types, and a similarity 
measurement so that he can then use one of many 
30 existing grouping algorithms (for example and non- 
limitatively, the Ascending Hierarchical Grouping, « K- 
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Means », « Fuzzy K-Means », Gaussian mix, GTM 
« Generative Topographic Mapping », GSOM « Generative 
Self Organizing Map » [7], Kohonen Map [9], Kohonen 
Self Organising Map [.8,9] algorithms, etc.) . 
5 In some particular modes of the learning 

method according to the invention, this automatic 
grouping of alarm types using one of the grouping 
methods mentioned above (in the with type grouping 
mode) is advantageously done either using a grouping 

10 method based on a semantic map of alarm types (in other 
words each alarm is processed like a sequence of 
symbols, or text, and these sequences are grouped), or 
by a grouping method based on the accumulation prof ile 
in time (normalised or not) , in the alarm log, for each 

15 alarm type . 

In all embodiments of the invention, it is 
obviously possible to learn chronicles in partial alarm 
logs obtained after step b) in the method following a 

20 sequence of operations executed in series on a 
computer, during step c) in the method. 

However, in one advantageous embodiment of 
the invention that can even further reduce the 
processing time and that is compatible with the various 

25 modes described, these learning operations in step c) 
are executed in parallel on a computer. These 
chronicle learning operations take up most of the time 
among the various operations related to other steps in 
the method according to the invention; however, it is 

30 clear that these operations, can also be carried out in 
parallel to save time. 
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In the preferred embodiment of the 
invention, developed and used for supervision of a 
telecommunication system and used on a computer for 
5 step a) in the general mode, the alarm log is broken 
down using the with breakdown mode in which the broken 
down parts or 'time slots' all have the same duration A 
= 2*T, where T is the maximum duration of chronicles to 
be learned that is fixed for the execution of step c) 

10 in the method, the breakdown being such that any two 
consecutive parts have a time overlap equal to the 
value T. This particular breakdown is such that if any 
instance of a chronicle (with maximum length T) is 
statistically present in J, then it will also be 

15 present in at least part of J. 

The alarm log J on which the method 
according to the invention is applied is broken down 
into p parts covering all alarms in the log, that may 
be assumed to be consecutive without restricting the 

20 general case; we will denote the i (th) part of the log 
as Oi, for 1 £ i £ p, then the start and the end dates 
associated with this part, D± and F± respectively, 
satisfy the relation: 

D ± = D + T* (i-1) 

25 F ± = Di + A, 

where D denotes the start date of the alarm 

log J, 

and for the next (i + l)th part, the start 
and end dates respectively D i+ i and F i+ i satisfy: 
30 Di+i = D + T*i = Di + T 

F±+i = D i+ i + A = Fi + T . 



Therefore, this breakdown is also conform 
with complete breakdown mode as can easily be checked. 

We then classify the set of o± values, where 
i varies from 1 to p, into r groups G k , 1 < k < r, 
using a grouping method based on Kohonen maps; each 
group G k (where 1 < k < r) of similar parts (or 
corresponding alarm sequences) comprising a variable 
number of parts (or alarm sequences) . Therefore, this 
final classification step applies to the with sequence 
grouping mode. In one preferred advantageous variant 
of the embodiment, the weighted representation is used 
to describe parts of J with a representation space 
comprising one dimension for each distinct alarm type 
in the log J. 

In step b) , a partial alarm log J k is made 
for each corresponding group G k starting from the union 
of the parts, or corresponding alarm sequences, of the 
group. Thus, no alarm sequence is omitted in any 
group. 

Finally, in step c) , frequent chronicles 
are automatically learned using the FACE learning 
software on each partial alarm log J k , 1 ^ k < r, 
obtained above. Therefore for each partial log J k , the 
result is a partial set E k composed of distinct 
frequent chronicles M(k) of J k : E k = { Ci < k) , C M(k ) } 
(where C m(k) , l<m ( k) <M ( k) , denotes a chronicle of J k ) . 
The final result being the set E of frequent chronicles 
of J, where E is formed from the union of all partial 
sets E k , for k = l,...,r. 
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The FACE software [4,6] is a learning tool 
particularly well adapted to alarms and chronicles 
produced by telecommunication systems; -however, other 
learning software is used in step c) in variants of the 
5 preferred embodiment. 

The chronicles obtained will then be used 
by the diagnostic module of a supervision system for 
identification of situations characteristic of the 
behaviour of the supervised dynamic system, 
10 In general, in the learning method for 

frequent chronicles in an alarm log according to the 
preferred embodiment: 

- a maximum duration T of chronicles to be 
learned in step c) is fixed; and, 
15 - in step a) , the difference between the 

end date and the start date of any part of the alarm 
log is equal to 2*T; and, 

the parts are broken down in the alarm log such that 
for any given part with start date D' , the part for 
20 which the subsequent start date D' ' is closest to D' , 
if it exists, is such that its start date D' ' is equal 
to the date D' plus T; and, 

the alarm sequences obtained in the alarm log are 
grouped automatically using an algorithm based on 

25 Kohonen self -organising maps; and 

in step b) , a partial alarm log is 
produced for each group of similar alarm sequences 
obtained in step a) , from the union of alarm sequences 
in the group of similar alarm sequences; and 

30 - in step c) , the FACE learning system is 

used for automatically learning the chronicles. The 
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preferred mode is a mode dependent on with complete 
breakdown mode and with sequence grouping mode. 
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